CySA+ Containment Eradication Recovery Quiz

1. What is the primary risk of restoring from backups without confirming the backup date predates the compromise?

Slow recovery time

Restoring the malware or compromised data

Increased network traffic

User account lockouts

2. Which communication step is critical during the recovery phase to maintain stakeholder confidence?

Provide frequent status updates on restoration progress

Avoid any communication until fully recovered

Send detailed technical reports daily

Communicate only with IT staff

3. True or False: After eradication, systems can be restored to production without validation testing.

True

False

4. What is the primary difference between eradication and recovery in incident response?

Eradication removes threats; recovery restores systems to normal operations

Recovery removes threats; eradication restores systems

They are identical processes

Eradication involves law enforcement; recovery does not

5. During the recovery phase, why is monitoring and logging essential after system restoration?

To detect reinfection or persistence mechanisms

To track user productivity

To comply with backup schedules

To reduce system costs

6. Which containment method is most appropriate when business continuity is critical and some risk is acceptable?

Full isolation

Complete shutdown

Short-term containment with monitoring

No containment

7. In incident containment, what does 'isolation' primarily prevent?

Data loss

Lateral movement and further infection

User access to files

System performance degradation

8. Which step should be completed before bringing a recovered system back into the production network?

Announce recovery to all users

Verify system integrity and apply security updates

Reset all passwords immediately

Delete incident logs

9. True or False: Patching a compromised system without removing the attacker's backdoor is an effective eradication strategy.

True

False

10. During eradication, what is the benefit of using forensic imaging before making system changes?

Preserves evidence for investigation and analysis

Speeds up malware removal

Eliminates the need for backups

Reduces storage requirements

11. Which containment strategy involves stopping an attack while preserving evidence and maintaining system availability?

Segmentation

Short-term containment

Long-term containment

Full isolation

12. Which of the following is a valid reason to implement long-term containment instead of immediate isolation?

To gather more forensic evidence while limiting damage

To reduce IT staff workload

To avoid notifying users

To delay incident reporting

13. During containment, what is the purpose of disabling user accounts associated with compromised credentials?

To prevent further unauthorized access

To permanently delete user data

To speed up system performance

To simplify password management

14. What should be validated immediately after system recovery to confirm integrity?

User login credentials

System functionality, file checksums, and security configurations

Network bandwidth

Hardware serial numbers

15. Which recovery approach rebuilds a system from clean installation media and verified backups?

Patch application

Clean recovery

Incremental recovery

Parallel recovery

16. True or False: Full system restoration from backup is always the safest recovery method.

True

False

17. What is the primary purpose of the recovery phase in incident response?

Identify the attacker

Restore systems and data to normal operations

Document all findings

Notify law enforcement

18. Which tool is commonly used to verify that malware has been completely removed from a system?

Antivirus and forensic scanning tools

Network protocol analyzer

Packet sniffer

Load balancer

19. In the eradication phase, what must be removed from all affected systems?

User accounts

Malware, backdoors, and unauthorized access points

All applications

Operating system files

20. What is the primary goal of network segmentation during incident containment?

Increase network speed

Isolate affected systems to prevent lateral movement

Reduce bandwidth usage

Simplify firewall rules

CySA+ Containment Eradication and Recovery Steps Quiz

1. What is the primary risk of restoring from backups without confirming the backup date predates the compromise?

2.

What first name or nickname would you like us to use?

2. Which communication step is critical during the recovery phase to maintain stakeholder confidence?

3. True or False: After eradication, systems can be restored to production without validation testing.

4. What is the primary difference between eradication and recovery in incident response?

5. During the recovery phase, why is monitoring and logging essential after system restoration?

6. Which containment method is most appropriate when business continuity is critical and some risk is acceptable?

7. In incident containment, what does 'isolation' primarily prevent?

8. Which step should be completed before bringing a recovered system back into the production network?

9. True or False: Patching a compromised system without removing the attacker's backdoor is an effective eradication strategy.

10. During eradication, what is the benefit of using forensic imaging before making system changes?

11. Which containment strategy involves stopping an attack while preserving evidence and maintaining system availability?

12. Which of the following is a valid reason to implement long-term containment instead of immediate isolation?

13. During containment, what is the purpose of disabling user accounts associated with compromised credentials?

14. What should be validated immediately after system recovery to confirm integrity?

15. Which recovery approach rebuilds a system from clean installation media and verified backups?

16. True or False: Full system restoration from backup is always the safest recovery method.

17. What is the primary purpose of the recovery phase in incident response?

18. Which tool is commonly used to verify that malware has been completely removed from a system?

19. In the eradication phase, what must be removed from all affected systems?

20. What is the primary goal of network segmentation during incident containment?